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Abstract We propose a scheme for performing quantum 
key distribution (QKD) which has the potential to beat 
schemes based on the direct transmission of photons between 
the communicating parties. In our proposal, the communicat¬ 
ing parties exchange photons with two quantum memories 
placed between them. This is a very simple quantum repeater 
scheme and can be implemented with currently available 
technology. Ideally, its secret key rate scales as the square 
root of the transmittivity of the optical channel, which is 
superior to QKD schemes based on direct transmission 
because key rates for the latter scale at best linearly with 
transmittivity. Taking into account various imperfections in 
each component of our setup, we present parameter regimes 
in which our protocol outperforms protocols based on direct 
transmission. 


1 Introduction 

One of the outstanding problems of quantum key distribution 
(QKD) is the question of how to distribute key over arbitrar¬ 
ily long distances. The transmittivity of an optical channel 
decreases rapidly as the length of the channel grows (expo¬ 
nentially, in the case of fiber). This imposes a strong limit 
on the secret key rate achievable when photons are directly 
transmitted from Alice to Bob over long distances. Takeoka, 
Guha, and Wilde have shown that, when multi-mode signals 
are sent through a pure-loss bosonic channel with transmit¬ 
tivity 7y c h, the secret key rate can be no greater than log 2 [(1 + 
Vch) /(I — ?7ch)] bits per mode per channel use Q]. This is pro¬ 
portional to r/ c h for small r/ ch , meaning that the key rate, too, 
decreases rapidly with distance. In order to improve this scal¬ 
ing behavior and achieve even a modest key rate at very long 
distances, it is necessary to look beyond direct transmission. 

One way to surpass the Takeoka-Guha-Wilde (TGW) 
bound is by using quantum repeaters 12. First described 
in a, these are auxiliary quantum devices placed along 
the channel between the communicating parties, effectively 
breaking it up into multiple low-loss channels. A full repeater 
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Fig. 1 Schematic of the proposed protocol. One QM sends entan¬ 
gled photons to Alice, the other to Bob. Once both parties success¬ 
fully measure photons using BB84 measurements, a Bell measure¬ 
ment (BSM) is performed on the QMs. 

scheme might involve the use of many stations, each con¬ 
taining multiple qubits ll3ll4ll5ll6ir7l[8H9llT0l . These resource 
requirements are too demanding for such a scheme to be 
practical at present. Conceptually, then, quantum repeaters 
represent a path to transcending the limit imposed by the 
TGW bound, but their implementation remains a subject of 
intense research. No experiment has been performed that 
beats the TGW bound over any distance. 

In this paper, we propose a simplified scheme which has 
the potential to beat the TGW bound. Two parties perform 
QKD by measuring photons sent from a central station 
containing two quantum memories (Fig. |TJ). If the station 
is placed midway between the parties, each photon need 
only travel half the distance between them. Moreover, the 
presence of the memories means that the probability of one 
party successfully measuring a photon is independent of 
the success of the other party. Together, these imply that 
the secret key rate for our protocol is expected to scale as 
yjrff. Such scaling would be a fundamental improvement 
over any scheme relying on direct transmission, and gives it 
the potential to surpass the TGW bound. Our paper studies 
whether this scheme can beat the TGW bound in practice, 
taking into account experimental imperfections. 

The protocol is basically a rudimentary quantum repeater 
scheme, but it can be implemented using currently available 
technology. Though not directly scalable, it represents a step 
towards the full implementation of quantum repeaters. It is 
similar in spirit to the protocol described in CD, except that 
in their proposal single photons or weak laser pulses are sent 
toward the central station instead of being emitted from the 
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QMs. Our protocol thus simplifies the experimental require¬ 
ments. 

The remainder of this paper is organized as follows. 
Sec. [2] describes our proposed protocol, and Sec. [3] lists the 
benchmarks we will compare it to. Sec. |4]describes how we 
mathematically model each component in our protocol; these 
models are assembled in Sec. [5] to produce an expression 
for the secret key rate of our protocol. In Sec. [6] we discuss 
the behavior of the key rate of our protocol as a function 
of the distance between the communicating parties. We 
also discuss variations of our protocol, and describe the 
parameter regimes required to beat the benchmarks listed in 
Sec. [3] In particular, we show that beating the TGW bound is 
within reach. Finally, we present some concluding remarks 
in Sec.|T| 

2 Description of the protocol 

The protocol we propose in this paper is illustrated in Fig. [I] It 
uses two quantum memories (QMs) in a central station placed 
between Alice and Bob, who wish to establish a secret key 
via QKD. We do not assume a particular implementation of 
the QMs, but we do require that each QM can be entangled 
with a single photon (as in, for example, ion-photon entan¬ 
glement lU2l or the DLCZ scheme 0]). The photonic degree 
of freedom used to encode qubits can be freely chosen; ex¬ 
amples include polarization or time-bin encoding. We further 
assume that the two QMs can be jointly measured in the Bell 
basis, either by applying a CNOT gate and directly measur¬ 
ing them or by mapping the memory states onto photons and 
performing an optical Bell measurement. Alice and Bob are 
connected to the central station by lossy optical channels, and 
each have measurement apparatuses that allow them to mea¬ 
sure incoming photons in one of two settings which corre¬ 
spond to mutually unbiased bases of the qubit subspace (as in 
BB84). We will call the bases X and Z. 

The procedure to produce one bit of raw key is as follows: 

1. An entangled memory-photon state is prepared in one of 
the QMs and the photon sent to Alice, who performs a 
BB84 measurement on the photon. This is repeated until 
she successfully detects a photon. 

2. Same as the previous step, but with Bob and the other 
QM. 

3. A Bell measurement is performed on the two QMs and 
the result announced to Bob. 

4. If Bob measured in the Z basis, he applies a bit flip to 
his BB84 measurement if the Bell measurement yielded 
|<? r+ ) or | *£'“). Similarly, if he measured in the X basis, 
he applies a bit flip if the Bell measurement yielded |^~) 
or |&-). 

This procedure is repeated until a sufficient amount of raw 
key is obtained. The rest of the protocol is the same as in 
efficient BB84 [13). 

The protocol described here admits of a few variations: 
the QMs could be simultaneously or sequentially loaded by 
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Fig. 2 Key rate per channel use per mode vs. distance for the bench¬ 
marks listed in Sec. [3] The thick curve corresponds to the TGW 
bound (benchmark 1). Parameter values are as given in Sec. [6] 

performing steps 1 and 2 either at the same time or in se¬ 
quence, and the position of the central station can be changed. 
In Sec. [6] we will explore the difference between simultane¬ 
ous and sequential loading as well as the effect of changing 
the position of the central station. 

3 Benchmarks 

In comparing our protocol to schemes based on the direct 
transmission of photons from Alice to Bob, the TGW bound 
ATI is the most stringent standard of comparison. We will, 
however, compare our protocol to other scenarios as well; this 
will make it easier to see how well it matches up to concrete 
schemes that can be performed in a lab. The direct transmis¬ 
sion benchmarks with which we will compare our protocol 
are as follows: 

1. The TGW bound on the secret key rate per mode, 

-Rtgw = log 2 (^:j-—\ (1) 

V 1 - Vch J 

where // c |, is the channel transmittivity. For small this 
reduces to Rtgw ~ (2/ln2)7y c h ~ 2.89?7ch. 

2. BB84 with an ideal single-photon source and an ideal de¬ 
tector setup (no errors and no losses other than channel 
loss). 

3. BB84 with an ideal single-photon source and a realis¬ 
tic detector setup (nonzero misalignment error and dark 
counts, imperfect detector efficiency). 

4. Decoy-state BB84 with a laser and a realistic detector 
setup. 

5. BB84 using a quantum memory as a single photon source 
and a realistic detector setup. 

Throughout this paper, we will use the efficient variant of 
BB84 in which the Z basis is measured much more frequently 
than the A' basis ma. 

The figure of merit to be considered is the key rate per 
mode. Because BB84 requires two optical modes when im¬ 
plemented with the usual polarization or time-bin encoding. 
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its key rate expression takes on a factor of 1/2. We may com¬ 
pare the key rate per mode of our protocol to those of the 
benchmarks above either on a per time unit or a per channel 
use basis. In this paper we will compare key rates per chan¬ 
nel use only, though the ultimate goal is of course to compete 
on a per time unit basis. Any reference to “key rates” in the 
remainder of this paper, then, should be taken to mean “key 
rates per mode per channel use”. Expressions for the key rates 
of benchmarks 2-5 are given in Appendix [A| 

Fig. 0 shows plots of key rate per channel use as a func¬ 
tion of the distance between Alice and Bob. Note that all of 
these benchmarks are proportional to p c h (within certain lim¬ 
its, depending on the benchmark). 


where L att is the attenuation length. 

The probability of error due to setup misalignment be¬ 
tween Alice and the central station is e mA ■ Setup misalign¬ 
ment rotates the qubit state of the photon; if we assume the 
rotation angle to be random and symmetrically distributed 
about 0, the initial memory-photon state \ ( 1> + ) becomes 

(l~e mA )\$ + )($ + \ + e mA \V-)(V-\ (5) 

when the photon reaches a detector. This holds for Bob as 
well, with misalignment error e m s- 

4.3 Detectors 


4 Component modeling 

In this section, we present a simple model of the behavior 
of each component in the setup described in Sec. [2] in the 
absence of eavesdropping. 


4.1 Quantum memories 


In this paper, we consider QMs that are adequately described 
by the following model. A photon-memory entangled state 
can be generated in a QM with probability r) p \ each attempt to 
do so requires a preparation time of T p . When a photon is suc¬ 
cessfully generated, it is maximally entangled with the QM; 
without loss of generality, we may take the initial memory- 
photon state to be the Bell state 0 + ). 

The memory-channel photon coupling efficiency is p c . 
This includes not only the probability of a photon entering 
the optical channel, but the success probability of any process 
that occurs between the memory and the channel. For exam¬ 
ple, it contains the probability of successfully performing a 
wavelength conversion (if such is necessary). 

The QM dephasing time is T 2 . We will model dephasing 
using the following map 0, which takes as input the initial 
state p of the QM and returns the state of the QM after it has 
dephased for time / : 


r t {p) := [1 - Adp(i)]p + A dp (t)ZpZ (2) 


where 

, . , 1 - e ~ t ! T ' 1 

Adp(f) 7 ) 


(3) 


and Z is the Pauli Z operator. In this model, the off-diagonal 
elements of p go to zero as t —» 00 . 


4.2 Channels 

Alice and Bob are connected to the central station by optical 
channels of lengths L A and Lb respectively; the length of the 
total channel is therefore L = L A + L B . The speed of light 
through these channels is c. The transmittivity of a channel of 
length l is 

(4) 


For their BB84 measurements, Alice and Bob each use a de¬ 
tector setup consisting of an optical element that can distin¬ 
guish photonic qubit states in the X and Z bases (such as 
a polarizing beam splitter for polarization qubits) and two 
threshold detectors. We assume that they actively choose the 
basis in which to measure. Each detector has a dark count 
probability of pd', each setup has efficiency pd- 

If a photon heading towards one of the setups is in the 
state p, the effect of dark counts can be mimicked by photons 
which are effectively in the modified state 

a{p)p+[l-a(p)}^, (6) 


where 


a(p) := 


77(1 -Pd) 

1 - (! - T7)(1 -Pd.) 2 


(7) 


and r] is the probability that the photon reaches the detector 
setup. This assumes the use of a squashing map m which 
randomly assigns a measurement outcome to events in which 
both detectors click, reflected by p being mapped into the 
maximally mixed state. 


4.4 Bell state measurement 

The probability of successfully performing a Bell state mea¬ 
surement (BSM) on the two QMs is pbsm- 

We model errors in the BSM by applying the depolarizing 
channel 


^Absm (p) = AbsmP + (1 — Absm) ^ (8) 

to the QMs before a perfect BSM. The parameter Absm indi¬ 
cates how close the actual BSM is to an ideal BSM. When p 
is pure, Absm is related to the fidelity by 


F, s „ = (9 ) 

Because the fidelity is jointly concave, this is the minimum 
fidelity with which a BSM can be achieved. 


Vch(l) = e l/Lm 
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5 Key rate analysis 

The secret key rate is lower bounded by Il3ll5l 

R = ^-[1 - h(e x ) ~ fh{e z )]- (10) 

Here, the yield Y is the probability per channel use that Alice 
and Bob’s measurements, as well as the BSM, were success¬ 
ful. h(e) is the binary entropy function, ex and ez are the 
quantum bit error rates (QBERs) between Alice and Bob in 
the X and Z bases, and / is the error correction inefficiency. 
The factor of 1/2 comes from the fact that our protocol re¬ 
quires the use of two optical modes. 

Because the total channel between Alice and Bob is di¬ 
vided in two by the central station and because the number of 
signals sent over each segment of the channel may in general 
be different, it is not immediately clear how to count channel 
uses. To be conservative, we define the number of channel 
uses required to produce one bit of raw key to be the greater 
of the number of times Alice or Bob used their segments of 
the channel during the production of that bit. (Note that this 
is not the sum of the number of times Alice and Bob used 
their segments of the channel, even in the case of sequential 
loading.) 


5.2 Quantum bit error rates 

Taking into account all the parameters listed in Sec. [4] we find 
(in the absence of eavesdropping) that 

tt-X — AgSMtT (ijA )tT ) [^m (1 ^dp) T (1 

+ 7 >[ 1_ A B sm a(t] A )a{r] B )] (15) 

ez = ABSMa(?M)a( r ?s)£m + ^[1 ~ AbsmO^mMpb)] 

(16) 

where 

E-m t? m ^4(l ^mit) T (1 (17) 

£d p = E[Adp(f>t)[l — Adp(fs)] + [1 — Adp(f J 4)]Adp(fs)] ■ 

( 18 ) 

We may interpret £ m and £d p as the total misalignment and 
dephasing errors, respectively, between Alice and Bob. Here 
tA and t n are the times that Alice and Bob’s QMs are left to 
dephase for. 

At this point, we have fully determined ez in terms of the 
parameters set out in Sec. [4] In order to evaluate ex, we need 
only two more quantities: the dephasing time intervals t A and 
is. These are the subject of the following subsection. 


5.1 Yield 

The probability that a photon emitted from the central station 
is detected by Alice is 

Va~V tote~ LA/Lm . (ID 

where we have defined 


Vtot ■= r] p r] c r] d . (12) 

Due to the effect of dark counts, the probability that her de¬ 
tector clicks is 


rj' A :=l-(l- VA )(l-p d ) 2 . (13) 


Let N a denote the number of photons that need to be sent 
to Alice so that her detector clicks once; it is a geometrically 
distributed random variable with success probability Ex¬ 
pressions similar to the above apply for Bob. 

The average number of channel uses required for both Al¬ 
ice and Bob’s detectors to click is E[max(A^ 4 , Nb)] where E 
is the expected value operator. The yield is therefore 


Y = 


Pbsm 


E[max(/Vyi, Nb)] 


— Pbsm 


1 1 
Va Vb 


1 

Va + Vb - VaV'b 



(14) 


5.2.1 Dephasing Each time a QM emits a photon towards 
Alice, she must signal whether or not she successfully mea¬ 
sured her photon before the QM prepares another one. This 
constrains the amount of time that elapses between photons 
to be at least 


TA — T p + 


2 La 
c 


(19) 


Similar remarks apply to Bob. 

If it happens that L A / Lb, then ( [T9| ) allows the QMs to 
run at different rates. Throughout this paper, we will assume 
that each QM runs at the maximum rate allowed by ([191). 11 
is possible to choose the rates to be the same, but we will not 
do so in this paper. 

For both sequential and simultaneous loading, we may as¬ 
sume without loss of generality that Bob signals a successful 
measurement later than Alice does. The BSM is performed as 
soon as he does, so the QM that sends him photons dephases 
for a time 

t B = —- (20) 

c 

The QM that sends photons to Alice dephases for a longer pe¬ 
riod of time because it must wait for Bob to make a success¬ 
ful measurement. If the QMs are sequentially loaded, Alice’s 
QM dephases for 


C = ^BTB + —. 


( 21 ) 


If they are loaded simultaneously, then it dephases for 


tT = | N b 


N a \t b + — 


The expectation value was evaluated in CD. 


c 


( 22 ) 
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In because of the linearity of the operator E, we need 
only evaluate E[e -tA / T2 ]. For sequential loading. 


E[e~W T >] = 


rf n ex P(- 2 c ^) 


e rs / T2 + r]' B — 1 

For simultaneous loading, a result from 132 gives 

‘ZLa 


(23) 


E 


r e -t$7T 2 t = p( cT2 ) 

v'a + ^b- VaVb 


1 


1 — e~ TB / T2 {l — 77^) 


1 - e -TB / T2 (l - 77 ^) 


- 1 


(24) 


6 Results 


R 

IQ " 3 



Fig. 3 Key rate per channel use vs. distance for simultaneous and 
sequential loading. The two curves are virtually indistinguishable. 


Unless otherwise noted, the following parameter values were 
used for the results in this section. They are plausible val¬ 
ues for an implementation of our protocol using trapped-ion 
quantum memories connected to Alice and Bob via optical 
fiber. A single ion fluorescence collection efficiency of 4.2% 
has been demonstrated in EO, a trapped-ion qubit was mea¬ 
sured to have a dephasing time of 2.5 s in G3, and a two- 
qubit gate was used to entangle two ions with a fidelity of 
99.3% (corresponding to Absm = 0.99) in fl~8l . 

- r] p (preparation efficiency) = 0.66 

- T p (preparation time) = 2 /is 

- r] c (photon-fiber coupling efficiency x wavelength con¬ 
version) = 0.04 x 0.3 

- T 2 (dephasing time) = 1 s 

- c (speed of light in optical fiber) = 2 x 10 8 m/s 

- L att (attenuation length) = 22 km 

- e m A (misalignment error) = e m B = 0.01 

- pd (dark count probability per detector) = 10 -8 

- rjd (detector efficiency) = 0.3 

- Pbsm (BSM success probability) = 1 

- Absm (BSM ideality parameter) = 0.97 

- / (error correction inefficiency) = 1.16 

For decoy-state BB84 (benchmark 4), we will set the mean 
photon number of the signal states equal to 1. For the above 
numbers, we find that r] tot = r] p r] c r]d = 0.0024. 

6.1 Protocol variations 

6.1.1 Simultaneous vs. sequential loading For this compar¬ 
ison, the central station is located halfway between Alice and 
Bob. 

We have found, for the parameter values given above, that 
simultaneous and sequential loading of QMs in our protocol 
yield almost indistinguishable key rates per channel use over 
all values of L for which the rates are nonzero (Fig. [3}. A 
rough comparison of the dephasing time intervals and /A."" 
suggests that this holds whenever tb / ( T 2 r ] tot ) is small over 
all values of L for which the key rates are nonzero. The pa¬ 
rameters we have used are within this regime: tb /(T^tot) = 


0.140 at L = 66 km. Outside of it, however, the difference 
can be dramatic: there are cases where the key rate is nonzero 
for simultaneous loading but not for sequential loading. 

Because we will always be well within the parameter 
regime where simultaneous and sequential loading give 
nearly the same key rate, we will consider only sequential 
loading in the remainder of this paper. 

6.1.2 Optimization of central station position When the 
QMs are sequentially loaded, it need not be true that placing 
the central station halfway between Alice and Bob will yield 
the maximum key rate. This is because there is an inherent 
asymmetry in our protocol in this case: Bob only begins 
making measurements after Alice has finished hers. 

Fig. [4] shows the behavior of the key rate (per channel 
use) as a function of L when the central station is placed 
at L/2 and when it is placed at the position that maximizes 
the key rate. For small L, both key rates are approximately 
the same, and scale proportionally to y/rp h = e ~ L /( 2L ^)_ 
When L becomes large enough for memory dephasing to 
become significant, the unoptimized key rate drops to zero. 
Around that same point, the optimized key rate transitions 
from e ~ L /(. 2L ^) scaling to 77 ^ = e~ L / Lm scaling—which is 
the same as for direct transmission—and continues thus until 
L is so large that detector dark counts become significant, at 
which it too drops to zero. 

For greater insight into this behavior, consider Fig. [5] 
which shows the optimal central station position as a fraction 
of L as L is varied. For lower values of L, the station remains 
near the middle. Once dephasing becomes significant, the 
optimal position moves closer to Bob. This keeps dephasing 
errors low because Bob’s link runs quicker, giving Alice’s 
QM less time to dephase. At longer distances, the optimal 
position is a fixed distance away from Bob, just far enough 
away that the dephasing in Alice’s QM does not overwhelm 
the system with errors. The price of suppressing dephasing 
errors in this way is that the key rate scales with the transmit- 
tivity of the longer link in the setup, so the key rate scaling is 
degraded. 
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unoptimized 



L (km) 


Fig. 4 Key rate vs. distance when the central station is at L/2 and 
when its position is optimized. (r) c was increased to 0.3 to better 
show the features of the curves.) Near 150 km. the unoptimized key 
rate begins to drop to 0 and the optimized key rate transitions from 

e -L/(2£ att ) sca Jj n g to e -L/L m sca li n g 


t-opt 



Fig. 5 Optimal central station position as a function of the total dis¬ 
tance L. (Alice’s position is taken to be at L = 0.) Near where the 
scaling changes from e _I, /( 2i ati) t0 e ~ L / L m^ aj-ound £ = 150 km. 
the optimal position moves away from L/2 and remains a fixed dis¬ 
tance away from Bob. 


6.2 Beating direct transmission 

We are now in a position to determine the conditions 
under which our protocol can beat the direct transmission 
benchmarks listed in Sec. [3] First, note that at L = 0 the 
performance of our protocol may be worse than that of the 
benchmarks because the central station introduces additional 
sources of loss. However, because the key rate for our 
protocol scales better with distance than the benchmark key 
rates when L is not too large, crossover with one or more of 
them is possible at some L > 0. 

When the central station position is optimized, crossover 
can only occur in the e - L K 2L *a) regime (excluding marginal 
cases)—that is, when the optimal position is near the mid¬ 
point between Alice and Bob. Equivalently, crossover can 
only occur when the unoptimized key rate is nonzero. For 
this reason, we will fix the central station at L/2 for the re¬ 
mainder of this section instead of optimizing its position. It is 
worth mentioning that crossover with a certain benchmark 
does not mean that our protocol beats it for all L beyond 


t 2 



Fig. 6 Regions in p to t-T 2 space where our protocol beats each of 
the benchmarks listed in Sec. [3] together with approximations of 
their boundaries obtained usingj25) (dashed lines). For benchmark 
5 (quantum memory as single photon source), we have fixed r] c = 
0.3 x 0.3. 


the crossover point; the interval over which our protocol is 
superior may be quite small. But optimizing the central sta¬ 
tion position can potentially increase the range of distances 
over which our protocol beats the benchmark compared to 
the leaving the station at L/2. 

We identify two parameters, the combined efficiency p tot 
and the dephasing time T 2 , which are crucial in determining 
whether crossover occurs with any of the benchmarks and 
which can be improved from the values given at the begin¬ 
ning of this section. For example, the photon-fiber coupling 
efficiency in p c could be pushed from 0.04 to as high as 0.3 
lfT9l (leading to rj to t = 0.0178), while a T 2 of 50 s has al¬ 
ready been demonstrated lf20) . Fig. [ 6 ] shows the regions in 
t?tot -T 2 space in which we can beat each of the benchmarks. It 
is clear from the figure that we cannot beat any of the bench¬ 
marks with the parameters given at the beginning of the sec¬ 
tion, and that from our perspective, improving rj tot is more 
likely to result in crossover than improving T 2 . 

Each region may be explained in the following way. 
When L is small enough for errors to be negligible, the key 
rate of our protocol is R « R 0 e~ L ^ 2L ‘^ while that of the 
benchmark of interest is Hi, ss oe~ L ' Lm , where Rq and 
Ili, f) are the key rates at L = 0 of our protocol and of the 
benchmark respectively]^] These curves intersect at a distance 
Li nt . If Li nt is smaller than some characteristic distance Ld p 
beyond which dephasing becomes significant, then there is a 
crossover. The boundary of the crossover region corresponds 
to Li nt = Ldp. These ideas are illustrated in Fig. [7] 

Based on this explanation, we can derive an approximate 
formula for the boundary of the region in which crossover 


1 This does not quite apply to the TGW bound, which goes to 
infinity as L —> 0. In this case, one must continue the e~ L ^ L “ n be¬ 
havior all the way to L = 0 , so that Rb.o = 2 / In 2 . 
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Fig. 7 Approximating the crossover point using the scaling behav¬ 
ior of the key rates. Note that the intersection point of the approx¬ 
imating curves coincides with the crossover point of the key rate 
curves, and that the intersection occurs before dephasing becomes 
significant and the key rate of our protocol goes to 0. (We have set 
r/c = 0.3.) 


occurs with a given benchmark with key rate Rf,: 


T 2 = K 


' QT p 
. Vm 


2L att ln(Q/?7 

tot) 

C 



Here 


Q 


3Rb : o 

2i?g 10,=1 ’ 


(25) 


(26) 


i?Q t0,_1 denotes the key rate of our protocol when L = 0 and 
77t ot = 1, and K is a fitting parameter characterizing how 
long the QMs must dephase for, as a fraction of T 2 , before 
dephasing becomes significant. It needs to be chosen to fit 
the exact crossover region boundary; empirically, K = 14 
gives a good fit. This approximation is valid when T p -C T 2 
and pd <C Ptot/Q- A derivation is given in Appendix [ b] 

The dashed lines in Fig. [6] are the boundary approxima¬ 
tions given by (|25|. 


6.2.1 Attenuation length; the high-loss limit Let us now 
consider the high-loss limit , where the attenuation length L att 
is very small. This limit is interesting in the context of hybrid 
quantum-classical networks. In passive optical networks, 
where multiple users are connected to a source, each user is 
effectively connected to the source via a high-loss channel. 
The limit is also applicable when the wavelength of the 
photons emitted by the QMs happens to be greatly attenuated 
by the optical channel. 

The effect of reducing the attenuation length is to make 
it easier to beat the benchmarks, as shown in Fig. [8] and pre¬ 
dicted in ( |25| . This is because the photons cannot travel as far, 
so there is less dephasing. However, because of the nonzero 
preparation time T p , beating the benchmarks is still nontriv¬ 
ial in the L att —> 0 limit. The high-loss limit thus represents 
a regime in which experimental requirements are relaxed, yet 
the benchmarks can still meaningfully be beaten. 

Fig. [9] shows the effect of changing the preparation time 
T p and the dark count probability pd on the r]tot-T 2 regions 


t 2 



Fig. 8 Boundaries of regions in tyot-Th space where our protocol 
beats the TGW bound for various attenuation lengths. 


T 2 



Fig. 9 Boundaries of regions in fyot -T 2 space where our protocol 
beats the TGW bound in the limit L a ti —> 0. Solid lines indicate 
p d = 10 -8 , dashed lines p d = 10 -5 . Blue, orange, green, and red 
lines indicate T p = 100, 10, 5, and 0 p .s respectively. 


in which our protocol can beat the TGW bound. As expected 
from ( |25) l, the benchmarks become easier to beat as T p goes 
down. (This is true whatever the value of L att .) We also see 
that when T p = 0 and L att —> 0, they can be beat for any 
value of T 2 . Because there is no dephasing at all in this case, 
T 2 plays no role in determining whether there is a crossover. 

Equation ( [25] ) suggests that when T p = 0 and L att —t 0, 
crossover can happen for any value of p tot . However, Fig. [9] 
shows that crossover can happen only when r/ tot is sufficiently 
large. There is no contradiction: when rj to t is too low, the con¬ 
dition pd -C rgJQ is violated and ( |25[ > no longer holds. It 
turns out that there is no crossover when r] tot is small be¬ 
cause dark counts become significant. Using reasoning sim¬ 
ilar to that employed in deriving ( [25] ) (with the characteris¬ 
tic dephasing length L dp replaced with a characteristic dark 
count length Ld ), we can obtain the following approximation 
to the minimum ?/ tol necessary for our protocol to beat a given 
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benchmark: 


is lower bounded by 111311158 


c n = 


Qpd (2 -Pd)(i - £) 

(l -Pd)(pd + £-Pd£)‘ 


(27) 


The quotient of key rates at zero distance, Q , is as defined in 
( |26| , and depends on the choice of benchmark. The fitting pa¬ 
rameter £ is a measure of how much error due to dark counts 
our system can tolerate before the key rate drops to zero. For 
the parameter values given at the beginning of the section, 
£ = 0.012 fits well. This equation is valid when T p -C X 2 
and pd <C r /101 • The derivation is in Appendix [B] 


7 Conclusion 

In this paper, we have analyzed a QKD protocol in which Al¬ 
ice and Bob exchange signals with a central station consisting 
of two quantum memories: a rudimentary quantum repeater 
node. We have also introduced a number of benchmarks to 
which our protocol can be compared, the most important of 
them being the Takeoka-Guha-Wilde bound on the secret key 
rate. We showed that our protocol can, in principle, beat the 
benchmarks because of its improved rate-vs.-distance scal¬ 
ing: the key rate of all protocols relying on direct transmission 
between Alice and Bob scales at best with e~ L / Lm , while our 
protocol scales as e ~ L /( 2L ^). | n effect, our protocol doubles 
the attenuation length. Finally, we explored the conditions un¬ 
der which we can beat the benchmarks in practice. 

Because our protocol uses only one intermediate station 
with only two memories, we do not obtain the full scalability 
that quantum repeaters can offer us in theory. However, by the 
same token, it is feasible to implement using currently avail¬ 
able technology while still exhibiting the rate improvement 
of a full quantum repeater scheme and the ability to beat the 
TGW bound. Beating the bound would, in and of itself, be 
a fundamental experimental achievement—an achievement 
which we have shown to be within reach, particularly in the 
high-loss limit. Our protocol, then, is a first step towards the 
experimental implementation of quantum repeaters. 
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A Benchmark key rates 


R = y[l — h( e r) “ fh( e i)] (28) 

where 

V ■= t?tote _i/La " 

Yi := 1 — (1 — ? 7)(1 — Pd) 2 (29) 

ei Fi := Y 1 /2 - (1/2 - e m )j7(l - p d ). 

Here Yi and ei are the yield and QBER for single photons, 
/ is the error correction inefficiency, L is the length of the 
optical channel between Alice and Bob, and e m is the setup 
misalignment error probability. The other variables are as de¬ 
fined in Sec. [4] The factor of 1/2 comes from the fact that 
BB84 uses two optical modes. 

For an ideal single photon source (benchmark 3), rj p = 
rj c = 1. For an ideal detector setup (benchmark 2), 7 ^ = 1 
and pd = e m = 0. This amounts to setting e\ = 0 and results 
in R = e -i/ia, 72 = 7? c h/2. 

The key rate for decoy-state BB84 with a laser (bench¬ 
mark 4) is GQ 

tfdecoy = - h(e 1 )] - fQ P h(E p )) (30) 

where 

Qi := Yipte~^ 

Q/i := 1 — e -w (l - pd) 2 (31) 

E p Qu := QJ 2 - (1/2 - e m )(l - - p d ). 

Here //. is the average photon number for signal states; Yi, ei, 
/, and e m are as defined above. 


B Approximation of crossover regions in T 7 to t-T 2 space 

Throughout this appendix, we will assume that the QMs are 
loaded sequentially and that the central station is at L/ 2. Let 
Rb be the key rate for the benchmark whose crossover region 
we wish to approximate. 

We will first derive As outlined in the discussion 
leading up to that equation, our approach is to equate the in¬ 
tersection of the curves R 0 e~ L ^ 2Lm ' > and Rbpe~ L ^ Lm with 
some characteristic dephasing length /, dp in order to find the 
boundary of the crossover region. (i?o and /4.n are the key 
rates at L = 0 of our protocol and of the benchmark, respec¬ 
tively.) 

The first step is to find conditions under which 

R 0 oc Tfo,i?r =1 - (32) 


In this appendix, we give expressions for the secret key rates 
of benchmarks 2-5 in Sec. [3] For this purpose we model 
the observables in an experimental demonstration operating 
normally—that is, in the absence of eavesdropping activity. 

For benchmarks 2, 3, and 5, Alice transmits single pho¬ 
tons to Bob. In this case the efficient BB84 key rate per mode 


If P d is small and T p -C 7), then ex and ez are approxi¬ 
mately independent of // tol —see ([7]) and ( |23] l— and R 0 only 
depends on // t()l through Y. If we further assume that rj A « 
77 A- then 

v 7tot(2 — ?7tot) 2 

y = PBSM — - p. - TtPBSMVtot- (33) 

3 - 277tot 3 
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to first order in p loi . These conditions are therefore sufficient 
for the approximation in ( |32| to hold, with proportionality 
constant 2/3. 

Given this fact, the intersection of the two curves is at 


L int = 2L att ln( Q-) (34) 

\VtotJ 

where Q is defined in ( |26[ i. Note that T p <C T 2 implies that 
Q is independent of T 2 . 

We now derive a characteristic dephasing length by de¬ 
termining the distance at which Alice’s QM dephases for a 
significant fraction of T 2 . (Recall that Alice’s QM always de¬ 
phases longer than Bob’s.) That is, we put 


— = F( 7 seq 'l = ^ dp + ^dp/ c 

I\ A c p tot e -id p/( 2ia “) 


(35) 


where we have again used p' A ~ p a- The fitting parameter K 
defines the fraction of T 2 at which dephasing becomes signif¬ 
icant. 

Equation ( [35] ) cannot be solved for the dephasing length 
/. ( ip using elementary functions, but this is unnecessary: to 
find the crossover boundary, we need only substitute Lj nt for 
/. c ip. After a minor rearrangement of terms, this yields ( |25j ). 

It may appear that a small pd implies that rj' A « pa- 
It is true that pd -C 1 implies \rf A — t)a\ 1, but since 
Pa 1 and r/ A <C 1 in general, this is not strong enough 
to meaningfully say that r]' A « 7 / 4 . We require instead that 
Wa VaI/va "C 1. Moreover, because we have used p' A k, 
Pa in deriving ( [35] ), we require this to hold for all L up to 
/. ( ip—or, equivalently, up to /. lnt . By manipulating ( | 1 3[ i. we 
can write 


Wa~Va\ 

VA 


~~ 1 )^ 2pd ~ P ^ 



Pd- (36) 


If pa is close to 1, then ( 1/pa — 1 )pd is already small and 
the approximation holds. If pa -C 1, then (1/pa — 1 )pd ~ 
Pd/rjA , which is small for all L up to Lj nt whenp^ <C pf ot /Q- 
This condition, then, together with T p T 2 , guarantees the 
validity of ( [25| . 

Let us now derive ( |27| >. This time, we will compare /. lnl 
with a length /..i at which errors due to dark counts become 
significant. 

The error due to dark counts is related to 0 ( 7/4 )• defined 
in m We will put 1 — £ = cx(pa) where £ is a parameter 
indicating the amount of error the system can tolerate due to 
dark counts. Rearranging this equation, we obtain 


Ld — 2 /. a K In 


v tot( 1 - Pd){pd + g - PdCi \ 
Pd(2-Pd)(l-0 ) 


(37) 


By equating Ld and /. ml , we obtain \21\ . 

In deriving this equation, we have made no assumptions 
beyond those required for ( |32| ). In particular, we do not re¬ 
quire p' A « pa for all /. up to L| nt , but only at L = 0. This 
means that the condition on pd is less strict: p,/ <C p tot . 

Finally, we note that the condition pd pf 0 JQ, required 

for (|25|, can be obtained from a linearization of the square of 
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